Denial of service in Oracle Java SE - CVE-2019-2449

Vulnerability identifier: #VU17052

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-2449

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to unspecified flaw in Deployment component. A remote attacker cause the service to crash.

Oracle Java SE
IBM Cloud Transformation Advisor
Red Hat Satellite
EMC Data Protection Advisor
Dell EMC Data Protection Search
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
java-1.8.0-ibm-src (Red Hat package)
java-1.8.0-ibm-plugin (Red Hat package)
java-1.8.0-ibm-devel (Red Hat package)
java-1.8.0-ibm (Red Hat package)
java-1.8.0-ibm-jdbc (Red Hat package)
java-1.8.0-ibm-demo (Red Hat package)
EMC Integrated Data Protection Appliance
Data Computing Appliance (DCA)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

Install update from vendor's website.

IBM Cloud Transformation Advisor - update to 1.9.8
java-1.8.0-ibm-src (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
java-1.8.0-ibm-plugin (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
java-1.8.0-ibm-devel (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
java-1.8.0-ibm (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
java-1.8.0-ibm-jdbc (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
java-1.8.0-ibm-demo (Red Hat package) - addressed in versions 1.8.0.5.30-1jpp.1.el6_10, 1.8.0.5.30-1jpp.1.el7
EMC Integrated Data Protection Appliance - update to 2.3
Data Computing Appliance (DCA) - update to 3.5.3.0
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
EMC Data Protection Advisor - addressed in versions 6.5 patch 136, 18.1 patch 74, 18.2 patch 26
Dell EMC Data Protection Search - update to 18.2.1

• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixEM

• Multiple vulnerabilities in Oracle Java SE
• Multiple vulnerabilities in Dell EMC Integrated Data Protection Appliance
• Multiple vulnerabilities in Dell EMC Data Protection Advisor
• Multiple vulnerabilities in Dell EMC Search
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Red Hat Enterprise Linux 7 Supplementary update for java-1.8.0-ibm
• Red Hat Enterprise Linux 6 Supplementary update for java-1.8.0-ibm
• Red Hat Satellite 5 update for java-1.8.0-ibm
• Dell EMC Unity update for third-party components
• Multiple vulnerabilities in Oracle Java SE